RE: Session Hijacking

[Omar Herrera <oherrera () prodigy net mx>]

> -----Original Message-----
> From: Dragos Ruiu [mailto:dr () kyx net]
> > > Question, I am learning about session hijacking, and I was wondering
> > > if an IPS has the capabilities to detect and prevent this type of
> > > attack? If so how exactly would the IPS prevent a session hijacking?
> >
> > It's pretty much impossible to prevent full-knowledge session hijacking
> > when the hijacker is on a local network with who he is hijacking.  You
> > pretty much have to be their switch.
>
> It's an administrative hassle... but locking down mac addresses to switch
> physical ports _is_ a good idea... and raises the bar on hijacking.

And with some money, resources and a lot of patience, 802.1x might raise it
even further. This way, you effectively lock down port access without having
to manually lock them down on your switches.

2 more cents...

Omar Herrera 


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------